Data breachcritical
NetTraveler Is Back: The ‘Red Star’ APT Returns With New Tricks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2013-2465 | Unspecified Flaw in Oracle Java SE 2D Component Exploited in the Wild (CVE-2013-2465) | — | 99% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | weststock.org | l page link leads to a known NetTraveler-related domain at “weststock[dot]org”. Here’s the content of the page fetched from that URL: |
| domain | worldmaprsh.com | a previously unknown command and control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.1 |
| ipv4 | 198.211.18.93 | aprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.18.93. The IP is located in the U.S., at “Multacom Corporation” a |
| md5 | 15e8a1c4d5021e76f933cb1bc895b9c2 | n”. The payload of the exploit is a file named “file.tmp” ( 15e8a1c4d5021e76f933cb1bc895b9c2 ), which is stored inside the JAR. This is a classic NetTra |
| md5 | c263b4a505d8dd11ef9d392372767633 | simple HTML loads and runs a Java applet named “new.jar” ( c263b4a505d8dd11ef9d392372767633 ). The “new.jar” is an exploit for CVE-2013-2465, a very re |
| url | http://worldmaprsh[dot | cts to a previously unknown command and control server, at “hxxp://worldmaprsh[dot]com/gzh/nettr/filetransfer[dot]asp”, hosted at IP 198.211.1 |
From the original article
3 min read at securelist.com
NetTraveler, which we described in depth in a previous post, is an APT that infected hundreds of high profile victims in more than 40 countries.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.